Method and apparatus for time calibration

ABSTRACT

A local time is modified according to a radio wave time received from a time calibration signal transmitting station, as well as corrected according to an authentic time that is received from a time server when the difference between the local time and the radio wave time is less than a predetermined value as well as when the difference is equal to or greater than the predetermined value for a predetermined number of successive times. The local time is corrected while taking into consideration a delay period included in receiving the authentic time.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a technology for correcting a localtime of a time-stamping device that affixes a digital signatureincluding therein the local time to an electronic document.

2. Description of the Related Art

With the recent developments in the field of electronic authenticationtechnology, digital signatures that authenticate a creator or publisherof electronic documents have come to be widely used. The digitalsignature uses technology such as encryption key, etc. to enhance itsreliability. Further, attempts have been made to include the nationalstandard time (hereinafter, “standard time”) in the digital signature toauthenticate the creation time or transmission time of the electronicdocument.

A device that affixes a digital signature with a time stamp is generallyknown as a time-stamping device. The time-stamping device has aninternal clock. As well as clocking the local time according to theinternal clock, the time-stamping device also corrects the local time byreceiving radio waves that include the standard time, thereby enhancingthe accuracy of the time stamped in the digital signature.

To affix a digital signature with a time stamp, it is essential to keepthe difference between the local time of the time-stamping device andthe standard time within a predetermined threshold value. That is, byensuring that the difference between the time included in the digitalsignal and the standard time is kept within the predetermined thresholdvalue, the time stamp of the electronic document that is to be digitallysigned can be authenticated.

One method that may be employed for keeping the difference between thelocal time and the standard time within the predetermined thresholdlevel is by receiving the radio wave, as described earlier. Anothermethod is by connecting to a standard time managing server connected toa network and obtaining the standard time from the server. For instance,the standard time managing server disclosed in Japanese Patent Laid-OpenPublication No. 2002-229869 transmits the standard time with anexpiration data to a client device that is constantly connected to theserver, and detects any deviation or tampering with the internal clockof the client device.

However, in the conventional time-stamping device fraudulentfalsification of the local time cannot be prevented. For instance, thelocal time of the time-stamping device can be manipulated to be muchahead of or behind the authentic time with the aid of a radio waveincluding therein a false standard time instead of the true standardtime. Thus, the time stamp on the electronic document cannot beauthenticated with this kind of doctored local time.

Even if a mechanism is provided that monitors the difference between thelocal time of the time-stamping device and the standard time included inthe radio wave and determines that the clock has been tampered with ifthe difference exceeds the predetermined threshold value, the mechanismwill not be able to detect falsification of the local time when there isa combined influence of exposure of the time-stamping device to either ahigh temperature or a low temperature and a false radio wave.

Further, with the public preference for compact devices, the need of thehour is a compact time-stamping device that does not require to beconnected all the time to a network, such as a local area network (LAN),and that can be carried around like a wrist watch or a mobile, and usedwhenever required.

The conventional technology disclosed in Japanese Patent Laid-OpenPublication No. 2002-229869 cannot be applied to a compact time-stampingdevice since the technology needs the client device to be constantlyconnected to the network such as the LAN so that it can always be incommunication with the standard time managing server.

Thus, it is important to realize a time-stamping device that enhancesthe reliability of the time included in a digital signal by preventingfraudulent falsification of the time stamp as well as guarantees theauthenticity of the time stamp without having to be constantly connectedto a network.

SUMMARY OF THE INVENTION

A time-stamping device according to an aspect of the present invention,which affixes a digital signature including a local time clocked by aninternal clock to electronic data, includes: a radio-transmitted-timereceiving unit that receives a standard time included in a radio wave asa radio-transmitted time; an authentic-time receiving unit that receivesan authentic time synchronized with the standard time from a timeserver; a calculating unit that calculates an absolute value of adifference between the radio-transmitted time and the local time; a timemodifying unit that modifies, when the absolute value calculated is lessthan a first threshold value, the local time by setting theradio-transmitted time as the local time, and leaves, when the absolutevalue calculated is equal to or greater than the first threshold value,the local time as it is; and a time correcting unit that corrects thelocal time based on the authentic time received.

A time server according to another aspect of the present inventionincludes: a receiving unit that receives a local time signed with adigital signature of a client from the client; a calculating unit thatcalculates an absolute value of a difference between the local timereceived and a reception time of the local time; and a sending unit thatsends the local time received and an authentic time to the client whenthe absolute value calculated is less than a threshold value, whereinthe authentic time is the reception time signed with a digital signatureof the time server.

A method according to still another aspect of the present invention,which is a method for correcting a difference between a local timeclocked by an internal clock and a standard time, includes: receiving astandard time included in a radio wave as a radio-transmitted time;receiving an authentic time synchronized with the standard time from atime server; calculating an absolute value of a difference between theradio-transmitted time and the local time; modifying the local time bysetting the radio-transmitted time as the local time when the absolutevalue calculated is less than a threshold value; and correcting thelocal time based on the authentic time received.

A computer-readable recording medium according to still another aspectof the present invention stores a computer program that causes acomputer to execute the above method.

The above and other objects, features, advantages and technical andindustrial significance of this invention will be better understood byreading the following detailed description of presently preferredembodiments of the invention, when considered in connection with theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a time-stamping device according to anembodiment of the present invention;

FIG. 2 is a drawing representing time correction;

FIG. 3A is a drawing of a first example of the time-stamping device;

FIG. 3B is a drawing of a second example of the time-stamping device;

FIG. 3C is a drawing of a third example of the time-stamping device;

FIG. 4 is a block diagram of the time-stamping device;

FIG. 5 is a flowchart of an initial process when time correction is notcarried out;

FIG. 6 is a flowchart of the initial process when time correction iscarried out;

FIG. 7 is a flowchart of the processes of time modification and timecorrection;

FIG. 8 is a schematic diagram illustrating a delay compensation process;

FIG. 9 is a flowchart of the delay compensation process performed by thetime server;

FIG. 10 is a flowchart of the delay compensation process performed bythe time-stamping device;

FIG. 11 is a schematic diagram of a computer that executes a timecorrection program;

FIG. 12 is a schematic diagram of a conventional time-stamping device;

FIG. 13 is a drawing illustrating the process of altering the time of aninternal clock of the conventional time-stamping device; and

FIG. 14 is a drawing representing a drift in the time of theconventional time-stamping device due to tampering.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Exemplary embodiments of the present invention are explained in detailwith reference to the accompanying drawings.

A time-stamping device that incorporates a time correcting process,which is a feature of the present embodiment, is explained first withreference to FIG. 1 through FIG. 3C and FIG. 12 through FIG. 14.

Time-stamping device refers to a device that affixes a digital signatureincluding therein a time stamp on any digital data such as an electronicdocument. It has become commonplace in recent years to exchange digitaldata over the network, thus spawning the enterprise of authenticatingthe creation date, transmission date of the digital data (the so-called“time business”).

For example, apart from medical electronic document data such as amedical record or death certificate, or accounting or tax-relateddocuments such as sales account document or receipts, electronicdocuments to substantiate the date of invention of patents, digitalsignature with a time-stamping device can be affixed on image data,video data, etc. to authenticate the correct time at which these digitaldata were created or transmitted. Further, the time-stamping device canbe included in digital cameras and digital video cameras, therebyextending the application of time business to the fields where there isrequirement of date and time stamping.

Management of the time included in the digital signature is very crucialin the time business. In other words, the mechanism not only shouldensure accurate time, but also deter any fraudulent falsification of thetime. The time is likely to be tampered with for fraudulent activitiessuch as for concealing a medical blunder or for changing the date ofinvention in patents, etc. Thus, it is essential to deter such misdeedsby disabling alteration of time.

One aspect of the time business requires that the time is synchronizedbetween a facility or a device that issues reliable time and the severaltime-stamping devices that receive the time issued from the facility orthe device. Time servers serve as a reliable time source and providestandard time by connecting and presenting an authentication key to atime calibration signal transmitting station or a satellite that issuesradio waves including therein the standard time.

The businesses that manufacture and sell time-stamping devices forexpanding the time business must ensure that the difference between the“Time” stamped with the digital signature by the time-stamping deviceand the standard time does not exceed a predetermined value. Thisassurance will help establish time business.

However, the possible presence of defrauders who falsify the time in thedigital signature by altering the time can be a real threat to the verytime business as the time of creation or transmission cannot beauthenticated.

FIG. 12 is a schematic diagram of the conventional time-stamping device.An internal clock is provided inside the conventional time-stampingdevice. The time of the internal clock is modified by a radio time(T_(w)) included in the time calibration signal transmitted by the timecalibration signal transmitting station. During digital signature thetime stamp that is affixed is according to the modified internal clock.The conventional time-stamping device incorporates the so-called “radioclock” function and guarantees accuracy of time as long as it is nottampered with.

However, the conventional time-stamping device is prone to attack bydefrauders and allows time to be altered. FIG. 13 is a drawingillustrating the process of altering the time of the internal clock ofthe conventional time-stamping device.

As shown in FIG. 13, the defrauder carries the time-stamping device to aplace where the time calibration signal cannot reach, such as anunderground cellar, and subjects the time-stamping device to a radiowave (false radio wave) that is of the same type as the time calibrationsignal but whose time is shifted from that of the standard clock. Uponreceiving the false radio wave, the time-stamping device modifies thelocal time of the internal clock according to the false radio wave,thereby altering the local time to a time different from the genuinetime.

In the time-stamping device that modifies the time of the internal clockaccording to the radio wave time, if the difference between the localtime and the radio wave time exceeds a predetermined value (ε), often, apreventive measure of using the unmodified local time is adopted.However, when the false radio wave is used in conjunction withsubjecting the time-stamping device to either a high temperature or lowtemperature, this preventive measure fails.

All devices that have an internal clock generally have a crystaloscillator or a temperature compensated xtal oscillator (TCXO), which isbasically a crystal oscillator provided with a temperature-compensatingcircuit that offers stability in the face of temperature variation. Thetime-stamping devices meant to be used in diverse locations and thatinvolves several steps in terms of commodity circulation generally havea TCXO. The TCXO generally show a temperature characteristic thatproduces a quadratic curve which is basically convex, Y-axisrepresenting deviation (with values being positive from 0 up) and X-axisrepresenting temperature variation.

Thus, subjecting the time-stamping device that includes an oscillator toeither a high temperature or a low temperature slows down the internalclock. In the case of a TCXO, within the temperature range that allowsnormal functioning of the temperature-compensating circuit, control isexerted to bring the deviation close to 0. However, if the temperatureis above or below the range, the deviation gives rise to sudden timedelay.

If the temperature assault is combined with feeding a false radio wave,the difference between the local time and the radio wave time (radiowave time of the false radio wave) can be kept within the predeterminedvalue (ε). Consequently, the local time can be made to drift(hereinafter “drift due to tampering”) from the standard time by a largedegree. FIG. 14 is a drawing representing a drift in the time of theconventional time-stamping device due to tampering.

As shown in FIG. 14, if no tampering has taken place, the deviation ofthe local time from the standard time (authentic time) is kept between−ε and +ε by the preventive mechanism, where (ε) represents thepredetermined threshold value. However, if a temperature assault iscombined with feeding a false radio wave, the local time goes ondrifting from the authentic time, while maintaining the deviation rangeof the local time from the time included in the false radio wave between−ε and +ε.

Thus, in the conventional time-stamping device, the preventive measureagainst fraudulent falsification of the time is not adequate enough andhence time guarantee or time authentication, which is the object of atime-stamping device, cannot be assured. Therefore, the time-stampingdevice according to the present invention, which is provided with a timecorrection process, is equipped with a mechanism that deters fraudulentfalsification of the time.

FIG. 1 is a schematic diagram of the time-stamping device according tothe present embodiment. Apart from the radio wave time, thetime-stamping device according to the present embodiment also receivesan authentic time (T_(N)) from a time server via a network and correctsthe local time of the internal clock according to the authentic time.

The time server refers to a device that is connected to a network suchas the Internet and that provides, upon presentation of theauthentication key, a highly reliable standard time maintained by itover the network. In the present embodiment, the time-stamping device isdescribed as receiving the authentic time (T_(N)) from the time server.However, the time-stamping device may also receive the authentic time(T_(N)) from a server that is not provided with the standard timeissuing function but is connected to a time issuing device having thatfunction. Alternatively, the time-stamping device may receive theauthentic time (T_(N)) from the time issuing device directly connectedto the network.

FIG. 2 is a drawing representing time correction according to theauthentic time. FIG. 2 corresponds to FIG. 14 related to theconventional time-stamping device. The reference symbol T_(N)′ in FIG. 2represents the local time of the time-stamping device.

As shown in FIG. 2, in the time-stamping device according to the presentembodiment, a threshold value (σ) is set for guaranteeing time andcontrol is exerted so as to keep the difference between the local timeand the genuine time within the threshold value (σ). When apredetermined condition is satisfied, the authentic time (T_(N)) is setto the local time (T_(N)′), thus limiting the difference between thelocal time and the standard time to within the threshold value (σ). Thecontrol process is described in detail later.

By carrying out the time correction in this manner, the drift in thelocal time can be kept within the predetermined value (σ) even if thetime-stamping device is subjected to a temperature assault combined withfeeding a false radio wave, which was not possible in the conventionaltime-stamping device.

Thus, the time-stamping device according to the present embodiment givesan accurate time stamp according to the radio clock for genuine users,and ensures that the deviation of the local time from the standard timedoes not exceed the predetermined value (σ) in the event of anyattempted tampering. As the time-stamping device according to thepresent embodiment essentially shows time according to the timecalibration signal, when the deviation due to tampering builds up, thetime-stamping device according to the present invention receives theauthentic time (T_(N)) and corrects the local time. Consequently, theneed for the time-stamping device to be constantly connected to anetwork is obviated.

The different structures of the time-stamping device according to thepresent embodiment are explained next with reference to FIG. 3A throughFIG. 3C. The structures shown in FIG. 3A through FIG. 3C are supposedlyfor portable time-stamping device that is constructed with a view tomake it portable like a wrist watch or a mobile. However, it is alsopossible to adapt these structures for stationary time-stamping device.

FIG. 3A is a drawing of a first example of the time-stamping device. Inthis structure, the time-stamping device is connected to a universalserial bus (USB) port of a personal computer connected to the Internet.The time-stamping device thus connected receives the electronic documentto be digitally signed from the personal computer, affixes a digitalsignature on the electronic document using its local time (T_(N)′) andthe authentication key, and transfers the digitally signed document tothe personal computer. When correcting time, the time-stamping deviceconnects to the time server via the personal computer and the Internet,and receives the authentic time (T_(N)).

FIG. 3B is a drawing of a second example of the time-stamping device.The time-stamping device shown in FIG. 3B is similar to the one shown inFIG. 3A and is used by connecting to the USB port of the personalcomputer connected to the Internet. However, the function of affixingthe digital signature is carried out by a program installed in thepersonal computer.

When a digital signature is required, the personal computer sends anauthentication request message to the time-stamping device via the USBport. Upon receiving the message, the time-stamping device sends thelocal time and the authentication key to the personal computer. Thepersonal computer then affixes the digital signature on the documentusing the function of affixing digital signature that the personalcomputer itself possesses. When correcting time, the time-stampingdevice shown in FIG. 3B, like the one shown in FIG. 3A, connects to thetime server via the personal computer and the Internet.

FIG. 3C is a drawing of a third example of the time-stamping device. Thetime-stamping device shown in FIG. 3C is directly connected to theInternet. Upon receiving the electronic document to be digitally signedfrom an outside source, the time-stamping device affixes the digitalsignature using the local time (T_(N)′) and the authentication key, andoutputs the digitally signed electronic document. The document to bedigitally signed may be an electronic document stored in the internalmemory of the time-stamping device. When correcting time, thetime-stamping device shown in FIG. 3C connects to the time server viathe internet and receives the authentic time (T_(N)).

In the time-stamping devices shown in FIG. 3A through FIG. 3C, thedigital data to be digitally signed is assumed to be text data. However,image data or video data can also be digitally signed in the samemanner. Further, the time-stamping device may be incorporated in devicessuch as digital cameras and the images as they are taken may bedigitally signed.

FIG. 4 is a block diagram of the time-stamping device that includes thetime correction process, which is the feature of the present embodiment.A time-stamping device 1 shown in FIG. 4 may take the structure of anyof the time-stamping devices shown in FIG. 3A through FIG. 3C.

As shown in FIG. 4, the time-stamping device 1 includes a timecalibration signal receiver 2, an oscillator 3, a communicationinterface unit 4, a display unit 5, and an input unit 6, and furtherincludes a controller 10 and a memory unit 20.

The controller 10 includes a radio wave time receiving unit 11, a timemodification processor 12, a local time generating unit 13, an authentictime requesting unit 14, an authentic time receiving unit 15, a timecorrection processor 16, and a time stamping processor 17. The memoryunit 20 further includes an authentication key storing unit 21.

The time calibration signal receiver 2 receives the time calibrationsignal from a time calibration signal transmitting station or asatellite, and passes on the radio wave time (T_(W)) synchronized withthe national standard time to the controller 10. For instance, the timecalibration signal transmitted from the time calibration signaltransmitting station includes time information such as hour, minute,second, number of days from the start of the year, year (last two digitsaccording to western calendar), day of the week, etc. The timecalibration signal receiver 2 may be set to receive the time calibrationsignal at any time. For instance, the time at which the time calibrationsignal receiver 2 receives the time calibration signal may be specifiedas 7:00 hrs and 19:00 hrs. Apart from the set time, the user can alsobring about a forced reception of the time calibration signal at anytime.

The oscillator 3 clocks the local time of the crystal oscillator andfeeds the oscillated pulse to the controller 10. As the time-stampingdevice 1 is expected to be operated under a wide range of temperatures,and as an anticipatory measure against temperature assault with a viewto tamper with the time, it is preferable that TCXO is used as theoscillator 3, so that accuracy of time is guaranteed under a wide rangeof temperatures.

The communication interface unit 4 is a device such as the USB port, LANboard, etc., that allows two-way communication, and facilitates dataexchange between the time-stamping device 1 and the personal computer,as well as between the communication interface unit 4 and the controller10. Further, the communication interface unit 4 also allows dataexchange between the time-stamping device 1 and the time server.

The display unit 5 is a display device such as a liquid crystal displayand displays alerts, error information, etc. from the controller 10 andother devices. The input unit 6 is a power on/off button and is used forswitching the time-stamping device 1 on or off. The operation of theinput unit 6 is notified to the controller 10.

The controller 10 generates the local time and appropriately carries outtime modification according to the time calibration signal and timecorrection according to the authentic time, keeping the differencebetween the local time and the authentic time within the predeterminedvalue, and affixes the digital signature using the local time.

The radio wave time receiving unit 11 receives the radio wave time(T_(W)) from the time calibration signal receiver 2 and passes it on tothe time modification processor 12. The time modification processor 12uses the radio wave time (T_(W)) received from the radio wave timereceiving unit 11 to modify the local time (T_(N)′) generated by thelocal time generating unit 13.

Specifically, the time modification processor 12 calculates an absolutevalue (|T_(W)−T_(N)′|) of the difference between the radio wave time(T_(W)) and the local time (T_(N)′) and compares the absolute value(|T_(W)−T_(N)′|) with the predetermined threshold value (ε). If theabsolute value (|T_(W)−T_(N)′|) is less than the threshold value (ε)(that is, if |T_(W)−T_(N)′|<ε), the time modification processor 12replaces the local time (T_(N)′) with the radio wave time (T_(W)). Whenthe absolute value |T_(W)−T_(N)′| is less than the threshold value ε apredetermined number of successive times, it acts as a trigger for theauthentic time requesting unit 14 to make a request to the time serverfor the authentic time.

If the absolute value (|T_(W)−T_(N)′|) is equal to or greater than thethreshold value (ε) (that is, if (|T_(W)−T_(N)′|≧ε), the timemodification processor 12 does not modify the local time (T_(N)′). Whenthe absolute value (|T_(W)−T_(N)′|) is equal to or greater than thethreshold value (ε) a predetermined number of successive times, it actsas a trigger for the authentic time requesting unit 14 to make a requestto the time server for the authentic time.

The local time generating unit 13 receives the pulse output from theoscillator 3 and generates the local time (T_(N)′) based on the pulse.The local time (T_(N)′) is subjected to time modification process by thetime modification processor 12 according to the radio wave time (T_(W))as well as to the time correction process by the time correctionprocessor 16 according to the authentic time (T_(N)). The local timegenerating unit 13 notifies the generated local time (T_(N)′) to theauthentic time requesting unit 14 and the time stamping processor 17.

The authentic time requesting unit 14, at specified times, makes arequest to the time server connected to the network for the issue of theauthentic time using the local time (T_(N)′) generated by the local timegenerating unit 13 and the authentication key stored in theauthentication key storing unit 21. When making the request for theissue of the authentic time, the authentic time requesting unit 14encrypts the request message containing the local time (T_(N)′) usingthe authentication key and sends the encrypted request message to thecommunication interface unit 4.

The authentic time requesting unit 14 can be forcibly made to requestfor the authentic time by the user. In addition, the authentic timerequesting unit 14 makes a request for the authentic time upon triggeredby “number of successive times |T_(W)−T_(N)′|<ε” and “number ofsuccessive times |T_(W)−T_(N)′|≧ε” calculated by the time modificationprocessor 12.

For instance, assuming that ε is 0.5 second, and that the timemodification processor 12 performs time modification according to theradio wave time (T_(W)) once a day, and that the authentic timerequesting unit 14 makes a request to the time server for the issue ofthe authentic time when “number of successive times |T_(W)−T_(N)′|<ε”becomes 90, the correction process according the authentic time (T_(N))is performed when the local time (T_(N)′) deviates from the genuine timeby a maximum of 45 seconds (90×0.5). Thus, the deviation of the localtime (T_(N)′) can be kept within the predetermined value even if a falseradio wave is fed combined with temperature assault.

Forcible request for the issue of the authentic time is accomplished bythe user at any time by pressing the appropriate button to bring aboutforcible request for the authentic time with the aid of the input unit6, causing the authentic time requesting unit 14 to make a request tothe time server on the network for the issue of the authentic time.Forcible request may also be accomplished by displaying “number ofsuccessive times |T_(W)−T_(N)′|<ε or period in which |T_(W)−T_(N)′|<ε”or “number of successive times |T_(W)−T_(N)′|≧ε or period in which|T_(W)−T_(N)′|≧ε” on the display unit 5 and urging the user to selectforcible request.

The authentic time requesting unit 14 may not await user operation toact as a trigger for making a request for the authentic time but may onits own periodically make a request to the time server for the authentictime based on the local time (T_(N)′) generated by the local timegenerating unit 13. For instance, if the deviation of the local timefrom the standard time is 0.5 second per day, to keep the differencebetween the standard time and the local time within 45 seconds, theauthentic time requesting unit 14 may be instructed to make a request tothe time server for the authentic time once every 90 days.

The authentic time receiving unit 15 receives the authentic time(T_(N)), issued by the time server in response to the request made bythe authentic time requesting unit 14, via the communication interfaceunit 4, and passes on the authentic time (T_(N)) to the time correctionprocessor 16. The authentic time receiving unit 15 decrypts theencrypted authentic time (T_(N)) using the authentication key stored inthe authentication key storing unit 21.

The time correction processor 16 corrects the local time (T_(N)′)generated by the local time generating unit 13 according to theauthentic time (T_(N)) received from the authentic time receiving unit15. The reason for calling the time adjustment process as “modification”when it is performed based on the radio wave time, and the “correction”when it is performed based on the authentic time is explained next.

The radio wave time formerly was considered as a standard for the localtime as the radio waves could be depended upon for their lack of delayand hence accuracy. However, since the radio wave time can bemanipulated as explained with reference to FIG. 2, the radio wave timecannot be assumed to be completely reliable.

On the other hand, the authentic time is more reliable than the radiowave time as an authentication key is required to receive the authentictime. Therefore, to differentiate the time adjustments made according tothe radio wave time and the authentic time, different names—adjustmentand correction, respectively, have been given for the processes.

The time correction processor 16 calculates an absolute value(|T_(N)−T_(N)′|) of the difference between the authentic time (T_(N))and the local time (T_(N)′) and compares the absolute value(|T_(N)−T_(N)′|) with the predetermined threshold value (σ). If theabsolute value (|T_(N)−T_(N)′|) is less than the threshold value (σ)(that is, if |T_(N)−T_(N)′|<σ), the time correction processor 16replaces the local time (T_(N)′) with the authentic time (T_(N)).

If the absolute value (|T_(N)−T_(N)′|) is equal to or greater than thethreshold value (σ) (that is, if |T_(N)−T_(N)′≧σ), the time correctionprocessor 16 instructs the authentic time requesting unit 14 to make arequest for the authentic time (T_(N)) without correcting the local time(T_(N)′).

The time stamping processor 17 affixes the digital signature, includingtherein a time stamp, on the electronic document using the local timeand the authentication key stored in the authentication key storing unit21. Prior to being used by the time stamping processor 17, the localtime, which is generated by the local time generating unit 13, issubjected to time modification and time correction by the timemodification processor 12 and the time correction processor 16,respectively. Specifically, the time stamping processor 17 receives theelectronic document to be digitally signed via the communicationinterface unit 4, affixes a digital signature on the electronicdocument, and outputs the digitally signed electronic document via thecommunication interface unit 4.

The memory unit 20 is a storage device and is a volatile random accessmemory (RAM) and includes the authentication key storing unit 21, whichis pre-allocated at the manufacturing stage, in which the authenticationkey is stored. Once the authentication key is stored in theauthentication key storing unit 21, the memory unit 20 is constantlypowered. The powering of the memory unit 20 is to prevent any illegalaccess of the authentication key. In other words, when an attempt ismade to tamper with the time-stamping device 1 to get hold of theauthentication key, the power supply to the memory unit 20 is halted,thereby erasing the authentication key stored therein.

FIG. 5 is a flowchart of the initial process when time correction is notcarried out. FIG. 6 is a flowchart of the initial process when timecorrection is carried out.

When no time correction based on the authentic time is carried out, asshown in FIG. 5, the radio wave time receiving unit 11 forcibly receivesthe radio wave time (T_(W)) via the time calibration signal receiver 2,and the time modification processor 12 modifies the local time (T_(N)′)generated by the local time generating unit 13 by replacing the localtime (T_(N)′) with the radio wave time (T_(W)), thus setting the radiowave time (T_(W)) as the local time (T_(N)′) (step S101) and ending theinitial process.

When time correction based the authentic time is to be carried out, asshown in FIG. 6, the radio wave time receiving unit 11 forcibly receivesthe radio wave time (T_(W)) via the time calibration signal receiver 2,and the time modification processor 12 modifies the local time (T_(N)′)generated by the local time generating unit 13 by replacing the localtime (T_(N)′) with the radio wave time (T_(W)), thus setting the radiowave time (T_(W)) as the local time (T_(N)′) (step S201).

Next, the authentic time requesting unit 14 connects to the time serverto make a request for the authentic time (T_(N)) (step S202). Theauthentic time receiving unit 15 temporarily stores the authentic time(T_(N)) received from the time server (step S203). The time correctionprocessor 16 compares the temporarily stored authentic time (T_(N)) andthe local time (T_(N)′) generated by the local time generating unit 13(step S204), and determines if the deviation (|T_(N)−T_(N)′|) betweenthe authentic time (T_(N)) and the local time (T_(N)′) is less than thecorrection threshold value (σ) (step S205).

If the deviation (|T_(N)−T_(N)′|) is less than the correction thresholdvalue (σ) (“Yes” at step S205), the time correction processor 16 usesthe local time (T_(N)′) as it is without carrying out any correction(Step S207). If the deviation (|T_(N)−T_(N)′|) is found to be equal toor greater than the correction threshold value (σ) (“No” at step S205),the time correction processor 16 determines whether the number ofsuccessive times the deviation (|T_(N)−T_(N)′|) is equal to or greaterthan the correction threshold value (σ) is equal to or greater than M(step S206).

If the number of successive times the deviation (|T_(N)−T_(N)′|) isequal to or greater than the correction threshold value (σ) is equal toor greater than a predetermined value M (“Yes” at step S206), the timecorrection processor 16 suspends the operation of the time-stampingdevice 1. If the number of successive times the deviation(|T_(N)−T_(N)′|) is equal to or greater than the correction thresholdvalue (σ) is less than the predetermined value M (“No” at step S206),the steps from step S201 onward are repeated. Either of the initialprocesses shown in FIG. 5 and FIG. 6 may be appropriately selecteddepending on the operation mode of the time-stamping device 1.Alternatively, the initial process to be used may be specifiedbeforehand.

The functioning of the time-stamping device 1 is explained withreference to FIG. 7. FIG. 7 is a flowchart of the processes of timemodification and time correction. As shown in FIG. 7, upon activatingthe time-stamping device 1, first a counter that counts the number ofsuccessive times the deviation exceeds the threshold value is reset(step S301). The radio wave time receiving unit 11 then receives theradio wave time (T_(W)) via the time calibrating signal receiver 2 (stepS302).

The time modification processor 12 calculates the difference between theradio wave time (T_(W)) and the local time (T_(N)′) and determineswhether the deviation (|T_(W)−T_(N)′|) is less than the modificationthreshold value (ε) (step S303). If the deviation (|T_(W)−T_(N)′|) isless than the modification threshold value (ε) (“Yes” at step S303), thetime modification processor 12 performs a modification process bysetting the radio wave time (T_(W)) as the local time (T_(N)′) (stepS304).

Next, the time modification processor 12 determines whether the numberof successive times the deviation (|T_(W)−T_(N)′|) is less than themodification threshold value (ε) is equal to or greater than apredetermined value α (step S305). If the number of successive times thedeviation (|T_(W)−T_(N)′|) is less than the modification threshold value(ε) is found to be equal to or greater than α (“Yes” at step S305), thesteps from Step S308 onward are carried out. If the number of successivetimes the deviation (|T_(W)−T_(N)′|) is less than the modificationthreshold value (ε) is found to be less than the predetermined value α(“No” at step S305) the steps from Step S302 onward are repeated.

If the deviation (|T_(W)−T_(N)′|) is equal to or greater than themodification threshold (“No” in step S303), the time modificationprocessor 12 makes no modification to the local time (T_(N)′) (stepS306). The time modification processor 12 then determines whether thenumber of successive times (|T_(W)−T_(N)′|) is equal to or greater thanthe modification threshold value (ε) is equal to or greater than apredetermined value β (step S307). If the number of successive times thedeviation (|T_(W)−T_(N)′|) is equal to or greater than the modificationthreshold value (ε) is found to be equal to or greater than apredetermined value β (“Yes” at step S307), the steps from step S308onward are carried out. If the number of successive times the deviation(|T_(W)−T_(N)′|) is less than the modification threshold value (ε) isfound to be less than the predetermined value β (“No” at step S307), thesteps from step S302 onward are repeated.

If the answer is “Yes” at steps S305 and S307, the authentic timerequesting unit 14 connects to the time server for making a request forthe authentic time (T_(N)) (step S308). The time correction processor 16receives the authentic time (T_(N)) via the authentic time receivingunit 15, calculates the difference between the received authentic time(T_(N)) and the local time (T_(N)′), and determines whether thedeviation (|T_(N)−T_(N)′|) is smaller than the correction thresholdvalue (σ) (step S309).

If the deviation (|T_(N)−T_(N)′|) is less than the correction thresholdvalue (σ) (“Yes” at step S309), the time correction processor 16 setsthe authentic time T_(N) as the local time T_(N)′ (step S310), and thesteps from step S201 onward are repeated. If the deviation(|T_(N)−T_(N)′|) is equal to or greater than the correction thresholdvalue (σ) (“No” at step S309), the time correction processor 16determines whether the number of successive times the deviation(|T_(N)−T_(N)′|) is equal to or greater than the correction thresholdvalue (σ) is equal to or greater than a predetermined value γ (stepS311). If the deviation (|T_(N)−T_(N)′|) is equal to or greater than thecorrection threshold value (σ) is found to be equal to or greater thanthe predetermined value γ (“Yes” at step S311), the time correctionprocessor 16 suspends the operation of the time-stamping device 1. Ifthe number of successive times the deviation (|T_(N)−T_(N)′|) is equalto or greater than the correction threshold value (σ) is found to beless than the predetermined value γ (“No” at step S311), the steps fromstep S308 onward are repeated.

A process of compensation for the delay when receiving the authentictime (T_(N)) from the time server is explained next with reference toFIG. 8 through FIG. 10. FIG. 8 is a schematic diagram illustrating thedelay compensation process the authentic time is subjected to. A networkdelay must be accounted for from the time the time-stamping device 1makes a request to the time server 101 for the authentic time (T_(N))until the time it receives the authentic time (T_(N)).

Specifically, suppose the time taken for the request for the authentictime T_(N) from the time-stamping device 1 to reach the time server 101is τ₁ and the time taken for the authentic time (T_(N)) to reach thetime-stamping device 1 from the time server 101 is τ₂. In other words,the time-stamping device 1 would receive the authentic time (T_(N)) fromthe time server 101 after a delay of τ₂. This delay does not pose aproblem if the delay is of the order of 100 msec. However, if a delay iscaused in the network by tampering, the authentic time (T_(N)) receivedby the time-stamping device 1 would not be accurate.

To obtain the accurate authentic time (T_(N)), the time-stamping device1 determines the sum of τ₁ and τ₂, and from this value estimates τ₂.Specifically, when sending a request to the time server 101, theauthentic time requesting unit 14 includes in an authentic time requestmessage 51 the local time (T_(N)′) at the instant when the request forauthentic time is made. Upon receiving the authentic time requestmessage 51, the time server 101 responds by sending a response message52 that includes the authentic time as well as the received local time(T_(N)′) to the time-stamping device 1. In FIG. 8, the reference symbol52 a represents the local time (T_(N)′) and the reference symbol 52 brepresents the authentic time (T_(N)) included in the response message52.

To calculate the to and fro time (τ₁+τ₂) for sending the request andreceiving the response, the time-stamping device 1 deducts 52 a (T_(N)′)included in the response message 52 from the reception time(T_(N)′+(τ₁+τ₂)) of the response message 52. The time-stamping device 1then calculates the delay-compensated authentic time by first obtainingτ₂ by halving (τ₁+τ₂), and then deducting τ₂ from the received authentictime (T_(N)).

In the present embodiment, τ₂ is calculated by halving the delay period(τ₁+τ₂) for a single request. However, an average of the delay periods(τ₁+τ₂) for a plurality of requests may be used to calculate τ₂.Alternatively, an average of the delay periods (τ₁+τ₂) for requests to aplurality of time servers 101 may be used to calculate τ₂.

FIG. 9 is a flowchart of the delay compensation process performed by thetime server. As shown in FIG. 9, upon receiving the local time (T_(N)′)from the time-stamping device 1 (step S401), the time server 101determines whether the absolute value of the difference between theauthentic time (T_(N)) maintained by the time server 101 itself and thereceived local time (T_(N)′) is less than a predetermined value (σ′)(step S402).

If the absolute value thus obtained is less than the predetermined value(σ′) (“Yes” at step S402), the time server 101 sends the received localtime (T_(N)′) and the authentic time (T_(N)) to the time-stamping device1 (step S403), thereby ending the process. However, if the absolutevalue of the difference between the authentic time (T_(N)) and thereceived local time (T_(N)′) is equal to or greater than thepredetermined value (σ′) (“No” at step S402), not only the time server101 suspends sending the authentic time (T_(N)) to the time-stampingdevice 1 but instead sends an alert to the time-stamping device 1 (stepS405), thereby ending the process.

Thus, the time server 101 does not provide the authentic time (T_(N)) tothe time-stamping device 1 whose local time (T_(N)′) deviates in a majorway from the authentic time (T_(N)). Consequently, the time-stampingdevice 1 can be effectively prevented from being used for fraudulentpurposes.

FIG. 10 is a flowchart of the delay compensation process performed bythe time-stamping device. As shown in FIG. 10, the time-stamping device1 sends the local time (T_(N)′) to the time server 101 (step S501). If,in response, the time server 101 sends an alert (“Yes” at step S502),upon receiving the alert, the time-stamping device 1 outputs the alerton the display unit 5 (step S510) and terminates the connection with thetime server 101.

If the message received from the time server 101 is not an alert (“No”at step S502), the time-stamping device 1 receives the authentic time(T_(N)) and the local time (T_(N)′) earlier sent to the time server 101from the message (step S503). The time-stamping device 1 then calculatesthe difference (τ₁+τ₂) between the reception time of the message and thelocal time (T_(N)′) included in the message, the difference (τ₁+τ₂)being the delay period in sending the request to and receiving theresponse from the time server 101.

Next, the time-stamping device 1 determines whether the value obtainedby halving the delay period (τ₁+τ₂) is less than a predetermined value(ε′) (step S505). If the value obtained by halving the delay period(τ₁+τ₂) is found to be less than the predetermined value (ε′) (“Yes” instep S505), the time-stamping device 1 sets the authentic time (T_(N))as the new local time (T_(N)′) (step S506), thereby ending the process.

If the value obtained by halving the delay period (τ₁+τ₂) is found to beequal to or greater than the predetermined value (ε′) (“No” in stepS505), the time-stamping device 1 determines whether the number ofsuccessive times the value obtained by halving the delay period (τ₁+τ₂)is found to be equal to or greater than the predetermined value (ε′) isof a predetermined value (step S507). If the number of successive timesthe value obtained by halving the delay period (τ₁+τ₂) is equal to orgreater than the predetermined value (ε′) is found to be of thepredetermined value (“Yes” at step S507), the time-stamping device 1outputs an alert (step S508) and terminates the connection with the timeserver 101. If the number of successive times the value obtained byhalving the delay period (τ₁+τ₂) is equal to or greater than thepredetermined value (ε′) is found to be less than the predeterminedvalue (“No” at step S507), the time-stamping device 1 outputs an alerton the display unit 5 (step S509) and repeats the steps from step S501onward.

Thus, according to the present embodiment, a local time generated by alocal time generating unit is modified according to a radio wave timereceived by a radio wave time receiving unit as well as correctedaccording to an authentic time received from a time server by anauthentic time receiving unit. An authentic time requesting unitreceives the authentic time when the difference between the local timeand the radio wave time is less than a predetermined value as well aswhen the difference between the local time and the radio wave time isequal to or greater than the predetermined value exceeds a predeterminednumber of successive times. A time correction processor corrects thelocal time taking into consideration a delay period included inreceiving the authentic time. Consequently, fraudulent falsification ofthe time can be prevented, thereby enhancing the reliability of the timeincluded in a digital signature. Further, reliable time stamp can beguaranteed without having to be constantly connected to a network.

The various processes explained in the present embodiment can berealized by a ready program installed in a computer. FIG. 11 is aschematic diagram of a computer that executes a time correction programwith the functions explained in the above embodiment.

The word “computer” refers not only to personal computers, but also theso-called “built-in computer” built into devices such as digitalcameras, digital video cameras, etc. The authenticity of data and timeon electronic data such as text data, image data, video data, etc. canbe guaranteed by enabling the execution of the time correction programon these computers.

As shown in FIG. 11, a computer 30 that functions as the time-stampingdevice includes a time calibration signal receiver 31, an oscillator 32,a communication interface unit 33, a display unit 34, an input unit 35,a volatile RAM 36, a read-only memory (ROM) 37, a central processingunit (CPU) 38, and a bus 39 that connects all the aforementioned parts.The time calibration signal receiver 31, the oscillator 32, thecommunication interface unit 33, the display unit 34, and the input unit35 of FIG. 11 correspond respectively to the time calibration signalreceiver 2, the oscillator 3, the communication interface unit 4, thedisplay unit 5, and the input unit 6 shown in FIG. 4. The computer 30 isconnected to another computer, the network, etc. via the communicationinterface unit 33.

The ROM 37 already has stored therein a time correction program 37 a.The CPU 38 loads the time correction program 37 a to execute it, causingthe time correction program 37 a to function as a time correctionprocess 38 a. The volatile RAM 36 stores an authentication key 36 a,which is used when the time correction program 37 a executes the timecorrection process.

The time correction program 37 a need not necessarily be kept readilyavailable in the ROM 37 but may be stored on a “portable physicalmedium” such as a flexible disk (FD), compact disk—read-only memory(CD-ROM), magneto optic disk (MO disk), or on “another computer (orserver)” to which the computer 30 is connected via a public circuit,Internet, LAN, wide area network (WAN) etc., and the computer 30 mayaccess and execute the program from these storage mediums.

According to the present invention, fraudulent falsification of the timecan be prevented, thereby enhancing the reliability of the time includedin a digital signature. Furthermore, the authenticity of the time can beguaranteed without having to be constantly connected to a network.Furthermore, by removing the effect of a delay caused in the network bytampering (in other words, by detecting the delay and preventing theauthentic time that has been subjected to the effect of the delay frombeing adopted as the local time), the reliability of the local time canbe ensured.

Additional advantages and modifications will readily occur to thoseskilled in the art. Therefore, the invention in its broader aspects isnot limited to the specific details and representative embodiments shownand described herein. Accordingly, various modifications may be madewithout departing from the spirit or scope of the general inventiveconcept as defined by the appended claims and their equivalents.

1. A time-stamping device that affixes a digital signature including alocal time clocked by an internal clock to electronic data, thetime-stamping device comprising: a radio-transmitted-time receiving unitthat receives a standard time included in a radio wave as aradio-transmitted time; an authentic-time receiving unit that receivesan authentic time synchronized with the standard time from a timeserver; a calculating unit that calculates an absolute value of adifference between the radio-transmitted time and the local time; a timemodifying unit that modifies, when the absolute value calculated is lessthan a first threshold value, the local time by setting theradio-transmitted time as the local time, and leaves, when the absolutevalue calculated is equal to or greater than the first threshold value,the local time as it is; and a time correcting unit that corrects thelocal time based on the authentic time received; wherein theauthentic-time receiving unit receives the authentic time from the timeserver when the absolute value calculated is less than the firstthreshold value a predetermined number of successive times.
 2. Atime-stamping device that affixes a digital signature including a localtime clocked by an internal clock to electronic data, the time-stampingdevice comprising: a radio-transmitted-time receiving unit that receivesa standard time included in a radio wave as a radio-transmitted time; anauthentic-time receiving unit that receives an authentic timesynchronized with the standard time from a time server; a calculatingunit that calculates an absolute value of a difference between theradio-transmitted time and the local time; a time modifying unit thatmodifies, when the absolute value calculated is less than a firstthreshold value, the local time by setting the radio-transmitted time asthe local time, and leaves, when the absolute value calculated is equalto or greater than the first threshold value, the local time as it is;and a time correcting unit that corrects the local time based on theauthentic time received; wherein the authentic-time receiving unitreceives the authentic time from the time server when the absolute valuecalculated is equal to or greater than the first threshold value apredetermined number of successive times.
 3. A time-stamping device thataffixes a digital signature including a local time clocked by aninternal clock to electronic data, the time-stamping device comprising:a radio-transmitted-time receiving unit that receives a standard timeincluded in a radio wave as a radio-transmitted time; an authentic-timereceiving unit that receives an authentic time synchronized with thestandard time from a time server; a calculating unit that calculates anabsolute value of a difference between the radio-transmitted time andthe local time; a time modifying unit that modifies, when the absolutevalue calculated is less than a first threshold value, the local time bysetting the radio-transmitted time as the local time, and leaves, whenthe absolute value calculated is equal to or greater than the firstthreshold value, the local time as it is; and a time correcting unitthat corrects the local time based on the authentic time received;wherein the authentic-time receiving unit receives the authentic timefrom the time server when a predetermined operation is carried out.
 4. Atime-stamping device that affixes a digital signature including a localtime clocked by an internal clock to electronic data, the time-stampingdevice comprising: a radio-transmitted-time receiving unit that receivesa standard time included in a radio wave as a radio-transmitted time; anauthentic-time receiving unit that receives an authentic timesynchronized with the standard time from a time server; a calculatingunit that calculates an absolute value of a difference between theradio-transmitted time and the local time; a time modifying unit thatmodifies, when the absolute value calculated is less than a firstthreshold value, the local time by setting the radio-transmitted time asthe local time, and leaves, when the absolute value calculated is equalto or greater than the first threshold value, the local time as it is;and a time correcting unit that corrects the local time based on theauthentic time received; wherein the time correcting unit corrects thelocal time by setting the authentic time received as the local time whenthe absolute value is less than a second threshold value.
 5. Atime-stamping device that affixes a digital signature including a localtime clocked by an internal clock to electronic data, the time-stampingdevice comprising: a radio-transmitted-time receiving unit that receivesa standard time included in a radio wave as a radio-transmitted time; anauthentic-time receiving unit that receives an authentic timesynchronized with the standard time from a time server; a calculatingunit that calculates an absolute value of a difference between theradio-transmitted time and the local time; a time modifying unit thatmodifies, when the absolute value calculated is less than a firstthreshold value, the local time by setting the radio-transmitted time asthe local time, and leaves, when the absolute value calculated is equalto or greater than the first threshold value, the local time as it is;and a time correcting unit that corrects the local time based on theauthentic time received; wherein the time correcting unit suspendsaffixing the digital signature to electronic data and outputs an alertwhen the absolute value is equal to or greater than a second thresholdvalue a predetermined number of successive times.
 6. A time-stampingdevice that affixes a digital signature including a local time clockedby an internal clock to electronic data, the time-stamping devicecomprising: a radio-transmitted-time receiving unit that receives astandard time included in a radio wave as a radio-transmitted time; anauthentic-time receiving unit that receives an authentic timesynchronized with the standard time from a time server; a calculatingunit that calculates an absolute value of a difference between theradio-transmitted time and the local time; a time modifying unit thatmodifies, when the absolute value calculated is less than a firstthreshold value, the local time by setting the radio-transmitted time asthe local time, and leaves, when the absolute value calculated is equalto or greater than the first threshold value, the local time as it is;and a time correcting unit that corrects the local time based on theauthentic time received; wherein the authentic-time receiving unitreceives the authentic time when a value obtained by halving a delayperiod between making a request for the authentic time to the timeserver and receiving the authentic time from the time server is lessthan a second threshold value.
 7. The time-stamping device according toclaim 6, wherein the authentic-time receiving unit once again receivesthe authentic time from the time server when the value is equal to orgreater than the second threshold value.
 8. The time-stamping deviceaccording to claim 6, wherein the authentic-time receiving unit receivesa plurality of authentic times from the time server and determines amean of a plurality of delay periods.
 9. The time-stamping deviceaccording to claim 6, wherein the authentic-time receiving unit receivesa plurality of authentic times from a plurality of time servers anddetermines a mean of a plurality of delay periods.
 10. The time-stampingdevice according to claim 6, wherein the authentic-time receiving unitrequests the time server for the authentic time by sending the localtime, and upon receiving a response that includes the local time as wellas the authentic time from the time server, calculates the delay periodby deducting the local time from a reception time of the response.
 11. Atime server for providing an authentic time for a time-stamping devicethat affixes a digital signature including a local time clocked by aninternal clock to electronic data comprising: a receiving unit thatreceives a local time signed with a digital signature of a client fromthe client; a calculating unit that calculates an absolute value of adifference between the local time received and a reception time of thelocal time; and a sending unit that sends the local time received andthe authentic time to the client when the absolute value calculated isless than a threshold value, wherein the authentic time is the receptiontime signed with a digital signature of the time server; and the sendingunit sends an alert signed with the digital signature of the time serverto the time-stamping device when the absolute value calculated is equalto or greater than the threshold value.
 12. A method for correcting adifference between a local time clocked by an internal clock and astandard time, the method comprising: receiving a standard time includedin a radio wave as a radio-transmitted time; receiving an authentic timesynchronized with the standard time from a time server; calculating anabsolute value of a difference between the radio-transmitted time andthe local time; modifying the local time by setting theradio-transmitted time as the local time when the absolute valuecalculated is less than a threshold value; and correcting the local timebased on the authentic time received; wherein the receiving includesreceiving the authentic time from the time server when the absolutevalue calculated is less than the threshold value a predetermined numberof successive times.
 13. A method for correcting a difference between alocal time clocked by an internal clock and a standard time, the methodcomprising: receiving a standard time included in a radio wave as aradio-transmitted time; receiving an authentic time synchronized withthe standard time from a time server; calculating an absolute value of adifference between the radio-transmitted time and the local time;modifying the local time by setting the radio-transmitted time as thelocal time when the absolute value calculated is less than a thresholdvalue; and correcting the local time based on the authentic timereceived; wherein the receiving includes receiving the authentic timefrom the time server when the absolute value calculated is equal to orgreater than the threshold value a predetermined number of successivetimes.
 14. A computer-readable recording medium that stores a computerprogram for correcting a difference between a local time clocked by aninternal clock and a standard time, wherein the computer program causesa computer to execute: receiving a standard time included in a radiowave as a radio-transmitted time; receiving an authentic timesynchronized with the standard time from a time server; calculating anabsolute value of a difference between the radio-transmitted time andthe local time; modifying the local time by setting theradio-transmitted time as the local time when the absolute valuecalculated is less than a threshold value; and correcting the local timebased on the authentic time received; wherein the receiving includesreceiving the authentic time from the time server when the absolutevalue calculated is less than the threshold value a predetermined numberof successive times.
 15. A computer-readable recording medium thatstores a computer program for correcting a difference between a localtime clocked by an internal clock and a standard time, wherein thecomputer program causes a computer to execute: receiving a standard timeincluded in a radio wave as a radio-transmitted time; receiving anauthentic time synchronized with the standard time from a time server;calculating an absolute value of a difference between theradio-transmitted time and the local time; modifying the local time bysetting the radio-transmitted time as the local time when the absolutevalue calculated is less than a threshold value; and correcting thelocal time based on the authentic time received; wherein the receivingincludes receiving the authentic time from the time server when theabsolute value calculated is equal to or greater than the thresholdvalue a predetermined number of successive times.